IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authentication flaw that allows a remote authenticated attacker to obtain an access token belonging to another user. The bug lies in the sign‑in flow, which fails to verify the identity of the user completing the process. The result is user impersonation, allowing the attacker to act with the privileges of another user, potentially exposing sensitive data or causing unauthorized operations.

The affected product is IBM API Connect. Vulnerable releases include 10.0.8.0 up to 10.0.8.12 and 12.1.0.0 up to 12.1.1.2, covering all components listed under the IBM:API Connect vendor/product line. Organizations running any of these releases should confirm their environment's specific version and apply the recommended update.

The CVSS score of 6.4 classifies the issue as moderate severity, but the presence of an exploitable authentication weakness makes the risk of compromise higher than the score alone suggests. The EPSS score is currently not available, so the likelihood of exploitation cannot be quantified, but the fact that the flaw requires only a valid authenticated session lowers the barrier for attackers in environments with weak access controls. The vulnerability is not listed in CISA KEV, indicating no widely reported exploit, yet the potential impact on confidentiality and integrity warrants immediate action.